[tpm2] Re: tpm2_nvdefine fails with inconsistent attributes...
Roberts, William C <william.c.roberts at intel.com>
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <SN6PR11MB3437BF76CBF82F9ADF0A0484B8539@SN6PR11MB3437.namprd11.prod.outlook.com> |
Ahh yeah we should add that attribute, we do it with the others like PPREAD. Does this fix your issue: https://github.com/tpm2-software/tpm2-tools/pull/2917 But yeah, on an actual machine that's booted, it's unlikely you can run against the platform hierarchy. ________________________________ From: Kenneth Goldman <kgoldman(a)us.ibm.com> Sent: Monday, January 10, 2022 3:42 PM To: Steven Clark <davolfman(a)gmail.com> Cc: Sievert, James <james.sievert(a)bsci.com>; tpm2 <tpm2(a)lists.01.org> Subject: [tpm2] Re: tpm2_nvdefine fails with inconsistent attributes... Correct. Unless you are the platform firmware, you don't typically have access to the platform hierarchy. It's reserved for use of the platform OEM. Post-OS applications use either the storage or endorsement hierarchy. From: Steven Clark <davolfman(a)gmail.com> Sent: Monday, January 10, 2022 4:09 PM To: Kenneth Goldman <kgoldman(a)us.ibm.com> Cc: Sievert, James <james.sievert(a)bsci.com>; tpm2 <tpm2(a)lists.01.org> Subject: [EXTERNAL] Re: [tpm2] Re: tpm2_nvdefine fails with inconsistent attributes... might also just be attempting to use platform authorization on real hardware while not being the system firmware. UEFI tends to lock out the platform on every boot because that's what it's supposed to do? On Fri, Dec 3, 2021, 6:52 ZjQcmQRYFpfptBannerStart It might also just be attempting to use platform authorization on real hardware while not being the system firmware. UEFI tends to lock out the platform on every boot because that's what it's supposed to do? On Fri, Dec 3, 2021, 6:52 AM Kenneth Goldman <kgoldman(a)us.ibm.com<mailto:kgoldman(a)us.ibm.com>> wrote: My guess is that you do not set the TPMA_NVA_PLATFORMCREATE attribute. The IBM utility sets it for you when the platform hierarchy authorizes the command, since it must be set. -- Ken Goldman kgoldman(a)us.ibm.com<mailto:kgoldman(a)us.ibm.com> 914-945-2415 (862-2415) [Inactive hide details for "Sievert, James" ---12/03/2021 09:37:25 AM---Hi, I’m using tpm2-tools 4.1.1 on Ubuntu 20.04. I’m i]"Sievert, James" ---12/03/2021 09:37:25 AM---Hi, I’m using tpm2-tools 4.1.1 on Ubuntu 20.04. I’m issuing the following command which is returnin From: "Sievert, James" <james.sievert(a)bsci.com<mailto:james.sievert(a)bsci.com>> To: "tpm2(a)lists.01.org<mailto:tpm2(a)lists.01.org>" <tpm2(a)lists.01.org<mailto:tpm2(a)lists.01.org>> Date: 12/03/2021 09:37 AM Subject: [EXTERNAL] [tpm2] tpm2_nvdefine fails with inconsistent attributes... ________________________________ Hi, I’m using tpm2-tools 4.1.1 on Ubuntu 20.04. I’m issuing the following command which is returning an inconsistent attributes error: bsci(a)ip-10-132-42-225:~$ tpm2_nvdefine 0x1000025 -C p -s 1 Hi, I’m using tpm2-tools 4.1.1 on Ubuntu 20.04. I’m issuing the following command which is returning an inconsistent attributes error: bsci(a)ip-10-132-42-225:~$ tpm2_nvdefine 0x1000025 -C p -s 1 WARNING:esys:src/tss2-esys/api/Esys_NV_DefineSpace.c:333:Esys_NV_DefineSpace_Finish() Received TPM Error ERROR:esys:src/tss2-esys/api/Esys_NV_DefineSpace.c:122:Esys_NV_DefineSpace() Esys Finish ErrorCode (0x00000182) ERROR: Failed to define NV area at index 0x1000025 ERROR: Esys_NV_DefineSpace(0x182) - tpm:handle(1):inconsistent attributes ERROR: Unable to run tpm2_nvdefine and yes, I am attempting to define the index using the platform hierarchy. ? This does work using the IBM utilities. Here are the current properties: bsci(a)ip-10-132-42-225:~$ tpm2_getcap properties-variable TPM2_PT_PERSISTENT: ownerAuthSet: 0 endorsementAuthSet: 0 lockoutAuthSet: 0 reserved1: 0 disableClear: 0 inLockout: 0 tpmGeneratedEPS: 0 reserved2: 0 TPM2_PT_STARTUP_CLEAR: phEnable: 1 shEnable: 1 ehEnable: 1 phEnableNV: 1 reserved1: 0 orderly: 0 TPM2_PT_HR_NV_INDEX: 0x6 TPM2_PT_HR_LOADED: 0x0 TPM2_PT_HR_LOADED_AVAIL: 0x3 TPM2_PT_HR_ACTIVE: 0x0 TPM2_PT_HR_ACTIVE_AVAIL: 0x40 TPM2_PT_HR_TRANSIENT_AVAIL: 0x3 TPM2_PT_HR_PERSISTENT: 0x0 TPM2_PT_HR_PERSISTENT_AVAIL: 0x11 TPM2_PT_NV_COUNTERS: 0x0 TPM2_PT_NV_COUNTERS_AVAIL: 0xD TPM2_PT_ALGORITHM_SET: 0x0 TPM2_PT_LOADED_CURVES: 0x2 TPM2_PT_LOCKOUT_COUNTER: 0x0 TPM2_PT_MAX_AUTH_FAIL: 0x20 TPM2_PT_LOCKOUT_INTERVAL: 0x1C20 TPM2_PT_LOCKOUT_RECOVERY: 0x15180 TPM2_PT_AUDIT_COUNTER_0: 0x0 TPM2_PT_AUDIT_COUNTER_1: 0x0 Any insight would be appreciated. Thanks!_______________________________________________ tpm2 mailing list -- tpm2(a)lists.01.org<mailto:tpm2(a)lists.01.org> To unsubscribe send an email to tpm2-leave(a)lists.01.org<mailto:tpm2-leave(a)lists.01.org> %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s _______________________________________________ tpm2 mailing list -- tpm2(a)lists.01.org<mailto:tpm2(a)lists.01.org> To unsubscribe send an email to tpm2-leave(a)lists.01.org<mailto:tpm2-leave(a)lists.01.org> %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s
attachment.htm
(text/html, 12.5 KB)
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1256">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Ahh yeah we should add that attribute, we do it with the others like PPREAD.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Does this fix your issue: <a href="https://github.com/tpm2-software/tpm2-tools/pull/2917" id="LPNoLPOWALinkPreview">https://github.com/tpm2-software/tpm2-tools/pull/2917</a></div>
<div class="_Entity _EType_OWALinkPreview _EId_OWALinkPreview _EReadonly_1"></div>
<br>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">But yeah, on an actual machine that's booted, it's unlikely you can run against the platform hierarchy.</span><br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Kenneth Goldman <[email protected]><br>
<b>Sent:</b> Monday, January 10, 2022 3:42 PM<br>
<b>To:</b> Steven Clark <[email protected]><br>
<b>Cc:</b> Sievert, James <[email protected]>; tpm2 <[email protected]><br>
<b>Subject:</b> [tpm2] Re: tpm2_nvdefine fails with inconsistent attributes...</font>
<div> </div>
</div>
<style>
<!--
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
@font-face
{font-family:"Segoe UI Emoji"}
p.x_MsoNormal, li.x_MsoNormal, div.x_MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif}
a:link, span.x_MsoHyperlink
{color:blue;
text-decoration:underline}
tt
{font-family:"Courier New"}
span.x_pfptpreheader1
{display:none}
span.x_EmailStyle36
{font-family:"Calibri",sans-serif;
color:windowtext}
.x_MsoChpDefault
{font-size:10.0pt}
@page WordSection1
{margin:1.0in 1.0in 1.0in 1.0in}
div.x_WordSection1
{}
-->
</style>
<div lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="x_WordSection1">
<p class="x_MsoNormal">Correct. Unless you are the platform firmware, you don't typically have access to the platform hierarchy. It's reserved for use of the platform OEM.</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">Post-OS applications use either the storage or endorsement hierarchy.</p>
<p class="x_MsoNormal"> </p>
<div style="border:none; border-left:solid blue 1.5pt; padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="x_MsoNormal"><b>From:</b> Steven Clark <[email protected]> <br>
<b>Sent:</b> Monday, January 10, 2022 4:09 PM<br>
<b>To:</b> Kenneth Goldman <[email protected]><br>
<b>Cc:</b> Sievert, James <[email protected]>; tpm2 <[email protected]><br>
<b>Subject:</b> [EXTERNAL] Re: [tpm2] Re: tpm2_nvdefine fails with inconsistent attributes...</p>
</div>
</div>
<p class="x_MsoNormal"><span class="x_pfptpreheader1"><span style="font-size:1.0pt; color:white">might also just be attempting to use platform authorization on real hardware while not being the system firmware. UEFI tends to lock out the platform on every boot
because that's what it's supposed to do? On Fri, Dec 3, 2021, 6:52 </span></span><span style="font-size:1.0pt; color:white">ZjQcmQRYFpfptBannerStart</span>
</p>
<p class="x_MsoNormal"><span style="font-size:1.0pt; color:white"><br>
<br>
</span></p>
<div>
<p class="x_MsoNormal">It might also just be attempting to use platform authorization on real hardware while not being the system firmware. UEFI tends to lock out the platform on every boot because that's what it's supposed to do?</p>
</div>
<p class="x_MsoNormal"> </p>
<div>
<div>
<p class="x_MsoNormal">On Fri, Dec 3, 2021, 6:52 AM Kenneth Goldman <<a href="mailto:[email protected]">[email protected]</a>> wrote:</p>
</div>
<blockquote style="border:none; border-left:solid #CCCCCC 1.0pt; padding:0in 0in 0in 6.0pt; margin-left:4.8pt; margin-right:0in">
<div>
<p><span style="font-size:10.0pt; font-family:"Arial",sans-serif">My guess is that you do not set the TPMA_NVA_PLATFORMCREATE attribute.</span><br>
<br>
<span style="font-size:10.0pt; font-family:"Arial",sans-serif">The IBM utility sets it for you when the platform hierarchy authorizes the command, since it must be set.<br>
<br>
--<br>
Ken Goldman <a href="mailto:[email protected]" target="_blank">[email protected]</a>
<br>
914-945-2415 (862-2415)<br>
</span><br>
<br>
<img border="0" width="16" height="16" id="x__x0000_i1027" alt="Inactive hide details for "Sievert, James" ---12/03/2021 09:37:25 AM---Hi, Im using tpm2-tools 4.1.1 on Ubuntu 20.04. Im i" style="width:.1666in; height:.1666in" data-outlook-trace="F:0|T:1" src="cid:[email protected]"><span style="font-size:10.0pt; font-family:"Arial",sans-serif; color:#424282">"Sievert,
James" ---12/03/2021 09:37:25 AM---Hi, Im using tpm2-tools 4.1.1 on Ubuntu 20.04. Im issuing the following command which is returnin</span><br>
<br>
<span style="font-size:7.5pt; font-family:"Arial",sans-serif; color:#5F5F5F">From:
</span><span style="font-size:7.5pt; font-family:"Arial",sans-serif">"Sievert, James" <<a href="mailto:[email protected]" target="_blank">[email protected]</a>></span><br>
<span style="font-size:7.5pt; font-family:"Arial",sans-serif; color:#5F5F5F">To: </span>
<span style="font-size:7.5pt; font-family:"Arial",sans-serif">"<a href="mailto:[email protected]" target="_blank">[email protected]</a>" <<a href="mailto:[email protected]" target="_blank">[email protected]</a>></span><br>
<span style="font-size:7.5pt; font-family:"Arial",sans-serif; color:#5F5F5F">Date:
</span><span style="font-size:7.5pt; font-family:"Arial",sans-serif">12/03/2021 09:37 AM</span><br>
<span style="font-size:7.5pt; font-family:"Arial",sans-serif; color:#5F5F5F">Subject:
</span><span style="font-size:7.5pt; font-family:"Arial",sans-serif">[EXTERNAL] [tpm2] tpm2_nvdefine fails with inconsistent attributes...</span></p>
<div class="x_MsoNormal">
<hr size="1" width="100%" noshade="" align="left" style="color:#8091A5">
</div>
<p class="x_MsoNormal" style="margin-bottom:12.0pt"><br>
<br>
<br>
<span style="font-size:7.5pt; font-family:"Times New Roman",serif; color:white">Hi, Im using tpm2-tools 4.1.1 on Ubuntu 20.04. Im issuing the following command which is returning an inconsistent attributes error: bsci@ip-10-132-42-225:~$ tpm2_nvdefine 0x1000025
-C p -s 1 </span><br>
<span style="font-size:10.0pt">Hi,</span><br>
<span style="font-size:10.0pt"> </span><br>
<span style="font-size:10.0pt">Im using tpm2-tools 4.1.1 on Ubuntu 20.04. Im issuing the following command which is returning an inconsistent attributes error:</span><br>
<span style="font-size:10.0pt"> </span><br>
<span style="font-size:10.0pt">bsci@ip-10-132-42-225:~$ tpm2_nvdefine 0x1000025 -C p -s 1</span><br>
<span style="font-size:10.0pt">WARNING:esys:src/tss2-esys/api/Esys_NV_DefineSpace.c:333:Esys_NV_DefineSpace_Finish() Received TPM Error</span><br>
<span style="font-size:10.0pt">ERROR:esys:src/tss2-esys/api/Esys_NV_DefineSpace.c:122:Esys_NV_DefineSpace() Esys Finish ErrorCode (0x00000182)</span><br>
<span style="font-size:10.0pt">ERROR: Failed to define NV area at index 0x1000025</span><br>
<span style="font-size:10.0pt">ERROR: Esys_NV_DefineSpace(0x182) - tpm:handle(1):inconsistent attributes</span><br>
<span style="font-size:10.0pt">ERROR: Unable to run tpm2_nvdefine</span><br>
<span style="font-size:10.0pt"> </span><br>
<span style="font-size:10.0pt">and yes, I am attempting to define the index using the platform hierarchy. </span><span style="font-size:10.0pt; font-family:"Segoe UI Emoji",sans-serif">?</span><span style="font-size:10.0pt"> This does work using the IBM utilities.
</span><br>
<span style="font-size:10.0pt"> </span><br>
<span style="font-size:10.0pt">Here are the current properties:</span><br>
<span style="font-size:10.0pt"> </span><br>
<span style="font-size:10.0pt">bsci@ip-10-132-42-225:~$ tpm2_getcap properties-variable</span><br>
<span style="font-size:10.0pt">TPM2_PT_PERSISTENT:</span><br>
<span style="font-size:10.0pt"> ownerAuthSet: 0</span><br>
<span style="font-size:10.0pt"> endorsementAuthSet: 0</span><br>
<span style="font-size:10.0pt"> lockoutAuthSet: 0</span><br>
<span style="font-size:10.0pt"> reserved1: 0</span><br>
<span style="font-size:10.0pt"> disableClear: 0</span><br>
<span style="font-size:10.0pt"> inLockout: 0</span><br>
<span style="font-size:10.0pt"> tpmGeneratedEPS: 0</span><br>
<span style="font-size:10.0pt"> reserved2: 0</span><br>
<span style="font-size:10.0pt">TPM2_PT_STARTUP_CLEAR:</span><br>
<span style="font-size:10.0pt"> phEnable: 1</span><br>
<span style="font-size:10.0pt"> shEnable: 1</span><br>
<span style="font-size:10.0pt"> ehEnable: 1</span><br>
<span style="font-size:10.0pt"> phEnableNV: 1</span><br>
<span style="font-size:10.0pt"> reserved1: 0</span><br>
<span style="font-size:10.0pt"> orderly: 0</span><br>
<span style="font-size:10.0pt">TPM2_PT_HR_NV_INDEX: 0x6</span><br>
<span style="font-size:10.0pt">TPM2_PT_HR_LOADED: 0x0</span><br>
<span style="font-size:10.0pt">TPM2_PT_HR_LOADED_AVAIL: 0x3</span><br>
<span style="font-size:10.0pt">TPM2_PT_HR_ACTIVE: 0x0</span><br>
<span style="font-size:10.0pt">TPM2_PT_HR_ACTIVE_AVAIL: 0x40</span><br>
<span style="font-size:10.0pt">TPM2_PT_HR_TRANSIENT_AVAIL: 0x3</span><br>
<span style="font-size:10.0pt">TPM2_PT_HR_PERSISTENT: 0x0</span><br>
<span style="font-size:10.0pt">TPM2_PT_HR_PERSISTENT_AVAIL: 0x11</span><br>
<span style="font-size:10.0pt">TPM2_PT_NV_COUNTERS: 0x0</span><br>
<span style="font-size:10.0pt">TPM2_PT_NV_COUNTERS_AVAIL: 0xD</span><br>
<span style="font-size:10.0pt">TPM2_PT_ALGORITHM_SET: 0x0</span><br>
<span style="font-size:10.0pt">TPM2_PT_LOADED_CURVES: 0x2</span><br>
<span style="font-size:10.0pt">TPM2_PT_LOCKOUT_COUNTER: 0x0</span><br>
<span style="font-size:10.0pt">TPM2_PT_MAX_AUTH_FAIL: 0x20</span><br>
<span style="font-size:10.0pt">TPM2_PT_LOCKOUT_INTERVAL: 0x1C20</span><br>
<span style="font-size:10.0pt">TPM2_PT_LOCKOUT_RECOVERY: 0x15180</span><br>
<span style="font-size:10.0pt">TPM2_PT_AUDIT_COUNTER_0: 0x0</span><br>
<span style="font-size:10.0pt">TPM2_PT_AUDIT_COUNTER_1: 0x0</span><br>
<span style="font-size:10.0pt"> </span><br>
<span style="font-size:10.0pt">Any insight would be appreciated. </span><br>
<span style="font-size:10.0pt">Thanks!</span><tt><span style="font-size:10.0pt">_______________________________________________</span></tt><span style="font-size:10.0pt; font-family:"Courier New""><br>
<tt>tpm2 mailing list -- <a href="mailto:[email protected]" target="_blank">[email protected]</a></tt><br>
<tt>To unsubscribe send an email to <a href="mailto:[email protected]" target="_blank">
[email protected]</a></tt><br>
<tt>%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s</tt></span><br>
<br>
<br>
</p>
</div>
<p class="x_MsoNormal">_______________________________________________<br>
tpm2 mailing list -- <a href="mailto:[email protected]" target="_blank">[email protected]</a><br>
To unsubscribe send an email to <a href="mailto:[email protected]" target="_blank">
[email protected]</a><br>
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s</p>
</blockquote>
</div>
</div>
</div>
</div>
</body>
</html>